I am trying to add a form for image upload for a custom slideshow for every post. The custom post type is called 'product'. The following snippet creates the new post type.

function product_register() {
    $args = array('label' => __('Product Manager'),
                  'singular-label' => __('Product'),
                  'public' => true, /*it is open to searches and stuff*/
                  'show_ui' => true, /*true implies that you can display a user interface for this post type in the admin panel*/
                  'capablitity_type' => 'post', /*this will build the read, edit and build capabilities*/
                  'hierarchical' => false, /*this tells you whether a post type is hierarchical*/
                  'has_archive' => true,
                  'supports' =>  array('title', 'editor', 'thumbnail', 'custom-fields','comments'), 
                  'rewrite' => array('slug' => 'Products', 
                                     'with_front' => false));
    register_post_type('products', $args);

After that, I created the meta box and the first few lines of the function that triggers when the post is saved. The problem lies with the save_files function. Despite the checks that I've put, the function still echos "Checks did not work". I'd like a function that runs only when I save the post, not when I initialize post-new.php.

add_action('load-post.php', 'file_uploader_meta');
add_action('load-post-new.php', 'file_uploader_meta');
function file_uploader_meta() {
    add_action('add_meta_boxes', 'setup_file_upload_meta_box');
    add_action('save_post', 'save_files', 10, 2);
//the following function creates the meta box
function setup_file_upload_meta_box() {
    add_meta_box('wp_custom_attachment', 'Slideshow Image Upload', 'display_meta_box', 'products', 'side', 'default');
//the following function will display your meta box
function display_meta_box() {
    wp_nonce_field(basename(__FILE__), 'image_upload_nonce');
    <form enctype="multipart/form-data">
        <p>All images must be jpg or pngs.</p>
        <p class="description">Upload the first slideshow image.</p>
        <input type="file" name="slideshow[]" />
        <p>Enter caption for first image.</p>
        <input type="text" name="first-image-caption" value="<?php echo get_post_meta($object->ID, 'first-image-caption', true); ?>" />
        <p class="description">Upload the second slideshow image.</p>
        <input type="file" name="slideshow[]" />
        <p>Enter caption for second image.</p>
        <input type="text" name="second-image-caption" value="<?php echo get_post_meta($object->ID, 'second-image-caption', true); ?>" />
        <p class="description">Upload the third slideshow image.</p>
        <input type="file" name="slideshow[]"/>
        <p>Enter caption for third image.</p>
        <input type="text" name="third-image-caption" value="<?php echo get_post_meta($object->ID, 'third-image-caption', true); ?>" />
function save_files($post_id, $post) {
    //first we prevent it from doing autosaves
    if(defined('DOING_AUTOSAVE') && DOING_AUTOSAVE):
    if(defined('DOING_AJAX') && DOING_AJAX):
    //we check to see if the current user has privileges to edit the post
    if(!current_user_can('edit_posts', $post_id)):
    //nonce check and rest of code goes here
        if(!isset($_POST['image_upload_nonce'])||!wp_verify_nonce($_POST['image_upload_nonce'], basename(__FILE__))) {
        echo "Checks didn't work";

Thank you very much for your help.

  • Had you tried not hooking it to 'load-post-new.php'? Also please elaborate on your definition of "save". There is a lot of saving goes on in WP, since it's essentially anything that modifies a post. – Rarst Jan 11 '15 at 17:46
  • Ok I will try that now. And by save I mean clicking on the 'publish'/'update' button. – saad Jan 11 '15 at 17:48
  • Not hooking it to 'load-post-new.php' makes the whole form disappear. Every tutorial used this hook. – saad Jan 11 '15 at 17:51
  • 1
    I meant the saving part, if you don't want it to be firing in that context. Although I am not sure on flow there without completely taking it apart in code. – Rarst Jan 11 '15 at 17:55
  • 1
    Use nonces to prevent such accidents. The new post page creates an auto-draft with wp_insert_post(). That’s when your callback is called. – fuxia Jan 11 '15 at 18:10

You can simplify your save handler by checking if the POST variable is set. If it isn't, no need to handle the request:

function save_files( $post_id, $post ) {
    if( ! isset( $_POST['image_upload_nonce'] ) || ! current_user_can( 'edit_post', $post_id ) )

    // Good to go, handle everything.

For an explanation on why the save_post hook is firing, see my other answer.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.